Localisation of PD databases

1

Local replication

Local data mirroring

A copy is kept in the country, transfer abroad is allowed.

2

Local storage

Explicit local data storage

Data physically stay in the country, remote cross-border processing is possible.

3

Forced localisation

De facto local storage and processing

A strict transfer regime and big fines make exporting data an unacceptable risk.

4

Domestic storage and processing

Explicit local storage and processing

The state directly bans cross-border transfer.

5

Discriminatory localisation

Discriminatory localization

Licensing and certification shut foreign companies out of processing.

Russia

RUSSIA HERE

Between models one and two

Initial collection is tied to Russian databases (Art. 18(5), 152-FZ), export afterwards follows CBT rules (Art. 12). No full transfer ban.

82

countries with localisation rules in 2025, in 2017 - 35

214

rules worldwide, in 2017 - 67

10

rules in Russia: third after China (33) and India (15)

When collecting PD, recording, systematising, accumulating, storing, updating and retrieving Russians' PD in databases outside Russia is not allowed, except under Art. 6(1)(2), (3), (4), (8). Mirror - Art. 16(4)(7), 149-FZ; foreign persons - Art. 10(4), Art. 16, 236-FZ.

Messages and metadata

Technical means and infrastructure

Sector information and documents

21.07.2014

Law 242-FZ

Added: Art. 18(5), 152-FZ; Art. 16(4)(7), 149-FZ

01.09.2015

START

Operators must run Russian citizens' PD operations in databases in Russia

01.09.2022

266-FZ

Localisation clause in the instruction, foreign processor is liable like the operator

01.07.2025

23-FZ

General ban on operations in foreign databases at collection

2026

PRACTICE

Elements of Art. 13.11(8) unchanged, cases back in general courts (508-FZ)

UNTIL 01.07.2025

When collecting PD, including via the Internet, the operator must ensure recording, systematisation, accumulation, storage, updating (revision, modification) and retrieval of Russian citizens' PD using databases located in Russia, except in cases under Art. 6(1)(2), (3), (4), (8).

From 01.07.2025

When collecting PD, including via the Internet, recording, systematisation, accumulation, storage, updating (revision, modification) and retrieval of Russian citizens' PD using databases located outside Russia are not allowed, except in cases under Art. 6(1)(2), (3), (4), (8).

Ahead: from 01.03.2027 sovereign AI models run only in Russian entities' data centres (243-FZ)

From 1 July it is forbidden to accumulate, store or update Russians' PD in any databases outside Russia. The previous rules allowed such data to be stored and processed abroad too, which created preconditions for leaks.

strict reading

AS

strict reading

Now not even copies of databases with Russians' PD may be abroad. Companies that ran such operations in foreign DBs must use Russian infrastructure.

AN

strict reading

This is part of the digital sovereignty strategy. Foreign services have a choice: localise infrastructure in Russia or leave the market.

VB

soft reading

Not an absolute CBT ban, but a clarification of primary processing and storage rules. Transfer of PD abroad after localisation in Russia is not excluded.

New Art. 18(5) was added for the second reading of 23-FZ, the explanatory note gives no aims. Three of four comments read it strictly.

OPERATORS ASK

When can an operator regard PD collection as complete?

RKN ANSWERS

Art. 18(5) sets no CBT limits on PD earlier collected using Russian databases in the cases of Art. 6(1), 152-FZ. Art. 12 and the notice of intent remain.

In practice: first record and update in a Russian database, then transfer to another party under Art. 12 with notice of intent.

• 24.03.2025 RKN, letters 08-134789 and 08-169079
• permits

Art. 18(5) does not limit CBT of PD collected in Russian databases, Art. 12 remains

• 12.05.2025 Digital Ministry, P25-44929
• tightens

updating and storage of Russians' PD, copies included, happen in Russian databases

• 04.08.2025 RKN, 08-373883
• clarifies

foreign metrics are CBT, allowed subject to Art. 18(5) and Art. 12

• 26.09.2025 RKN Office for Perm Krai
• clarifies

Google services: not CBT, but localisation applies

• 22.10.2025 RKN, oral
• tightens

parallel collection into Russian and foreign databases is out

• 01.11.2025 RKN, reply
• clarifies

Google Sheets with PD collected in Russia earlier: not CBT, notice not considered

• 12.01.2026 RKN, demand to take measures
• tightens

Google Sheets use breaches Art. 18(5), entailing Art. 13.11(8) of the CAO

• 22.01.2026 RKN, reply
• tightens

forms, chatbots, scripts sending PD abroad before Russian recording break the law

• 14.08.2026 RKN, open day
• tightens

storing or processing collected, localised PD abroad by the same operator is a breach of Art. 18(5), not CBT

Result: CBT of collected PD to another person is allowed, but a foreign twin of a Russian database at the same operator is a violation

• Operation
• until 01.07.2025
• from 01.07.2025
• Basis

RKN letters 24.03, 10.04.2025

Art. 18(5), RKN 22.10.2025 oral

• ?
• Digital Min. 12.05.2025, RKN oral 14.08.2026

• ?
• RKN demand 12.01.2026

expert view, Telecom Ministry 25.08.2015

Collected PD: obtained from subjects or representatives, taken from open sources, recorded by tracking behaviour. Generated: obtained from others, created by actions toward the subject, assigned, synthesised or predicted.

01

02

03

04

WHAT TO DO NOW

Rebuild the map of collection databases with locations

Check foreign copies, backups and recovery sites

Remove foreign office clouds from PD processes

Check collection pages: forms, metrics, captchas, chatbots

Update instructions signed before 01.07.2025

Initial collection of Russians' PD in databases in Russia, Art. 18(5), 152-FZ

State bodies' IS tools are hosted in Russia, no foreign databases for GIS, Art. 13(2.1), 149-FZ

From 01.01.2025 foreign software is banned on significant CII objects of state bodies and 223-FZ customers (Decree 166), move to trusted hardware-software systems by 01.01.2030

From 01.03.2027 sovereign and national models run in Russian data centres, 243-FZ

In 2025 the Digital Ministry proposed banning foreign clouds and software in PDIS for big business from 01.09.2027, not enacted

Practical takeaway: build the compliance strategy with a margin. Moving one database while keeping a foreign platform solves today's task, not tomorrow's.

2016

2018

2019

2022

2025

2026

* Jan - Sep 2026

04.08.2016

Tagansky District Court granted RKN's claim for an indefinite group of data subjects

10.11.2016

Moscow City Court upheld it

17.11.2016

LinkedIn entered in the violators register, telecoms began blocking

December 2016

RKN met a LinkedIn vice president: localisation requirements explained

07.03.2017

LinkedIn said no understanding was reached and the service stays blocked

RUSSIA ACCESS

10 years

unavailable in Russia since November 2016

COURT-FOUND BREACHES OF ART. 18(5)

Art. 18(5)

Art. 18(5)

FINDING

• Employment contract and job description
• Duty to submit data to RKN
• Official, Art. 2.4 of the CAO
• Art. 13.11(8) of the CAO liability

₽50k

instead of the ₽100-200k officials' sanction: first offence and remorse counted (Art. 4.1(2.2) of the CAO)

director, VGSPU German Language Centre

report 23.09.2020, ruling 26.10.2020

COMPANY LESSONS

13.02.2020

₽4m + ₽4m

Twitter, Facebook for refusing to move Russian users' databases to Russia

RKN repeatedly sent the companies letters demanding that Russians' data be stored on servers in Russia, with no replies.

ESCALATION LADDER

02.12.2019

405-FZ added Art. 13.11(8), (9): entities ₽1-6m, repeat ₽6-18m

13.02.2020

first (8) fines: ₽4m each on Twitter and Facebook

26.08.2021

repeat fines under (9): Twitter ₽17m, Facebook ₽15m

RKN LOCALISATION REQUEST

Certified layout of servers holding Russian users' data

Server sale contract and certificate of their registration

If capacity is rented in a Russian data centre - lease copy

Capacity data, data centre contracts (RKN letter 14.07.2023 No. 08VM-59834)

PREPARE IN ADVANCE

₽17m

₽15m

₽4m

₽3m

• repeat, (9): ₽6-18m
• first, (8): ₽1-6m

FOR 2021

₽39m

Enforcement: Facebook, Google and WhatsApp paid ₽22m (TASS). Twitter and Facebook faced repeat offences under Art. 13.11(9) 1.5 years after the first fines.

TOTAL FOR PERIOD

₽53m

repeat, (9): 2

first, (8): 15

Sokhnut: ₽1m, Frunzensky District Court of St Petersburg ruling of 01.03.2022. Snap: ₽1m, ruling of 28.07.2022

FINDINGS OF THE PROSECUTOR'S CHECK WITH RKN

DEFENCE PLEAS

COURT AND PROSECUTOR VIEW

RESULT

₽1m

Art. 13.11(8) CAO, appeal dismissed 01.03.2022. In July 2022 the Justice Ministry sued to liquidate the office, PD handling among the claims.

Lesson: a Russian database does not help if staff enter PD straight into a foreign system.

No targeting needed, open registration is enough

No Russian version, Russian policy or rouble payments, but no bar on Russians registering either, so the requirement applies.

248-FZ and Res. 336 do not protect

State control law does not apply to a person outside Russia.

Network data is PD

Localisation covers network activity data, device identifiers and cookies obtained by monitoring behaviour.

E-mail as a unique identifier

If registration needs only an e-mail address that cannot be reused, it identifies the user.

REPEAT CASE, 2023

The exact location of databases need not be proved

Safeguard: stating citizenship before access plus blocking Russian IPs, evidenced by screenshots and logs

https://example.ru/contacts

Feedback

Name

Phone

E-mail

• Not a robot
• Send

Privacy policy

• counter
• 1

2

3

4

1

2

3

4

TOTAL FOR PERIOD

₽133m

repeat, (9): 15

first, (8): 9

Agoda: fine replaced by a warning under Art. 4.1.1 CAO given localisation measures

TOTAL FOR PERIOD

₽118m

repeat, (9): 10

first, (8): 6

Google ₽6m (17.12.2024), MyHeritage ₽8m (22.01.2025), Hotels.com ₽6m

TOTAL FOR PERIOD

₽95.9m

repeat, (9): 10

first, (8): 23

Per court rulings and media reports. Google ₽3.8m - 18.08.2026, per media

MARCH - MAY 2026

20+

rulings of one Moscow precinct under Art. 13.11(8), (9)

Stable tariff: (8) - ₽1-2m, (9) - ₽6m. In August 2026 Google reportedly got ₽3.8m under (8).

Jurisdiction

From 2026 Art. 13.11 cases are back in general courts (508-FZ), arbitrazh courts finished those already taken.

Targeting bar

Free access from Russia, RU-domain registration and metrics from Russian devices suffice (Taobao, appeal 29.09.2026).

Registration block

Fails unless every collection channel is shut. Operator proves measures (Art. 2.1(2) CAO).

DB location

Established from the privacy policy and whois services, without technical expertise.

Limitation

Figma case dropped as time-barred. Courts date the violation from the day after the RKN request reply deadline.

Offence (8)

Unchanged after 01.07.2025 and describes failure to ensure Russian databases.

• 1
• Deputy head of Abinsky District administration found guilty, Art. 13.11(8) CAO

• 2
• The administration, as operator, processes PD through a website whose page code uses a US company's platform. The court classified this as CBT to the USA

• 3
• The platform held data on special military operation participants and their families, a security threat per the courts' press service

• 4
• No CBT notification was sent to RKN, the deputy head had been appointed responsible for it

• 5
• No proof was given that she took all measures in her power

CLASSIFICATION

Lesson for sites: foreign scripts and platforms in page code carry two risks at once - localisation and unnotified CBT.

DB FEATURES VIA ART. 1(1), 152-FZ

Medium

PD recorded on a physical medium

Systematisation

card index or other PD set

Set algorithm

PD search and access follow it

Non-automated processing is covered if it matches automated processing in nature. The same features set a DB apart from scattered records on any medium.

CIVIL CODE, ART. 1260

A set of independent materials systematised so that they can be found and processed by computer

Para. 2.1, GOST 34.321-96

A set of interrelated data organised under a database schema for user work

RKN, 09.11.2016

Ordered data set regardless of medium or processing means: archives, card files, e-databases, Excel table with PD

PDIS, ART. 3(10), 152-FZ

• PD in a database
• +
• processing methods
• +
• technical means

A DB is an integral part of a PDIS. A further feature of a set as a DB: it can formally be defined as a component of a PDIS in Russia.

RKN 22.10.2025 and 14.08.2026: office platforms are assessed by the PDIS definition, the specific service's functions and data flows in use.

RKN POSITIONS

POSITION: BACKUP EXAMPLE

Collection ends when a stable record fit for the DB's purposes forms in Russia

record formed in the Russian DB and fit for purpose

live processing of the record begins

a backup is made in parallel, first stored in Russia too

only then are data sent abroad

Defensible point: the Russian DB, formally a PDIS element. Who may receive next - next slide.

SEVEN SIGNS COLLECTION IS COMPLETE BEFORE EXPORT

• 1
• Data fully arrived in the Russian system

• 2
• The Russian database holds a stand-alone usable record

• 3
• The Russian stage goal is met: application, profile, request, HR file

• 4
• Russian DB stores, retrieves, updates the record without a foreign system

• 5
• A separate event, queue or procedure triggers transfer

• 6
• The foreign system gets no browser data before Russian recording

• 7
• The sequence is confirmed by logs

Features split collection from CBT but do not cancel review of the operator's own storage abroad (RKN 14.08.2026, oral).

Operator (Russia) - Processor abroad

instruction

Data stay with the same operator: copies, snapshots and backups abroad breach Art. 18(5)

Digital Min. 12.05.2025, RKN oral 14.08.2026

Operator (Russia) - Operator abroad

Art. 12, 152-FZ

Another party gets collected PD for its own purposes - CBT, not storage by the same operator

RKN 24.03.2025, Digital Min. 12.05.2025

INTER-OPERATOR AGREEMENT: COMMON PURPOSE WORDING, EACH PARTY FILLS IN ITS OWN

Independence in fact

inter-operator
agreement

Art. 6(3), 152-FZ

Operator-collected: localisation applies

Provided

Disseminated

Observed

Obtained otherwise or created by operator: no localisation

Acquired

Initiated

Assigned

Derived

Inferred

Registration via web form

name, e-mail, phone, date of birth

Provided

Class attendance records

login time, lessons viewed, device

Observed

Test result calculation

scores, test result, group ranking

Derived

Certificate issue

certificate no. and date

Assigned

• 1
• DB holds Russians' PD?
• no
• Exempt: no Russians' PD

yes

• 2
• Processing under Art. 6(1)(2), (3), (4), (8)?
• yes
• Exempt: exception to Art. 18(5)

no

• 3
• Does PD enter the DB at collection: from subjects, open sources, behaviour monitoring?
• no
• Exempt: data generated or obtained otherwise

yes

• 4
• Is collected PD written or updated directly in this DB?
• no
• Exempt: secondary DB, export abroad follows CBT rules

yes

Must be localised: initial record and update only in a Russian DB

• Decision
• May form a DB
• When collecting
• Conclusion

• Mail, chat, video calls
• messages and files in transit, no data schema
• forms, chatbots, contact lists
• per flow

• Cloud sheets and storage
• ordered-data file is a DB (RKN 09.11.2016)
• Google Sheets with Russians' PD breach (RKN 12.01.2026)
• exclude

• User directory, SSO
• yes, credentials are kept in it
• always, dependent systems rely on it
• localise

• BI, analytics
• yes
• no, if only aggregates without PD are loaded
• not required

• Metrics, captcha, widgets
• data go to an external service
• on every page visit
• Russian analogue

• Corporate mail with collection banned
• yes
• no, if the rules ban collection and are followed
• document

• 0
• Now

RU

abroad

• 1
• PDIS moved to Russia

RU

abroad

• 2
• Switch to paper

RU

abroad

• 3
• DB moved to Russia

RU

abroad

• 4
• Interim DB in Russia

RU

abroad

• 5
• PD transfer service

RU

abroad

• 6
• Giving up operator status

RU

abroad

• 7
• Depersonalisation or encryption

RU

abroad

• 8
• Parallel collection in Russia and abroad

RU

abroad

• 9
• Replicating the DB in Russia

RU

abroad

• 10
• Leave as is

RU

abroad

data subject

operator

user

application server

DBMS in RU

DBMS abroad

paper

depersonalisation, encryption

number colour - sanction risk

• cost, TCO
• detection
• detection
• court
• publicity
• sanction likelihood

• 1
• PDIS moved to Russia
• high
• 100%
• 0%
• 0%
• 0%
• 0%

• 2
• Switch to paper
• n/a
• 20%
• 20%
• 20%
• 0%
• 1%

• 3
• DB moved to Russia
• high
• 100%
• 20%
• 20%
• 20%
• 4%

• 4
• Interim DB in Russia
• low
• 100%
• 40%
• 20%
• 20%
• 8%

• 5
• PD transfer service
• low
• 80%
• 40%
• 40%
• 20%
• 13%

• 6
• Giving up operator status
• medium
• 100%
• 60%
• 40%
• 20%
• 24%

• 7
• Depersonalisation or encryption
• n/a
• 100%
• 60%
• 60%
• 20%
• 36%

• 8
• Parallel collection in Russia and abroad
• low
• 100%
• 80%
• 70%
• 40%
• 56%

• 9
• Replicating the DB in Russia
• medium
• 100%
• 80%
• 80%
• 40%
• 64%

• 10
• Leave as is
• no
• 100%
• 90%
• 90%
• 60%
• 81%

Percentages are illustrative, not dogma: probabilities are set by experts for each PDIS

cheap but risky

green zone: reliable but costly

100%

75%

50%

25%

0%

• no
• low
• medium
• high
• n/a

strategy cost over the lifecycle

sanction likelihood

• PDIS move
• 1
• 2

Paper

3

DB move

• Interim DB
• 4

• 5
• Transfer service

• 6
• Dropping status

• Depersonalisation
• 7

• 8
• Parallel collection

• 9
• Replication

• 10
• As is

CALCULATOR LEADERS

1

2

3

The decision is made per PDIS by lifecycle cost plus total risk, taking the system's business criticality into account.

Quantitative example, ₽m

• costs
• risks

• 0
• 1
• 2
• 3
• 4
• 5
• 6
• 7

• 1 PDIS move to Russia
• 2,0

• 2 Switch to paper
• 1,6

• 3 DB move to Russia
• 1,2

• 4 Interim DB
• 1,6

• 5 PD transfer service
• 1,6

• 6 Dropping status
• 1,7

• 7 Depersonalisation
• 3,4

• 8 Parallel collection
• 4,7

• 9 DB replica in Russia
• 5,7

• 10 Leave as is
• 6,5

Qualitative example: set-up × support

support costs

• no
• low
• medium
• high
• very high
• n/a

• no
• no
• low
• low
• medium
• high
• n/a

• low
• low
• low
• medium
• medium
• high
• n/a

• medium
• low
• low
• medium
• high
• high
• n/a

• high
• medium
• medium
• medium
• high
• very high
• n/a

• very high
• medium
• high
• high
• high
• very high
• n/a

• n/a
• n/a
• n/a
• n/a
• n/a
• n/a
• n/a

rows - set-up costs, n/a - not applicable

Quantitative is more precise, qualitative faster: start with the matrix for dozens of PDIS

TCO = CapEx + OpEx × T

CUMULATIVE COSTS, CALCULATOR POINTS

• The main cost item is labour to modify the PD processing workflow
• Same one-off costs, different cost of ownership: by year five moving the DB costs two thirds more than moving the whole PDIS

The 30.05.2025 reform's turnover-based fines concern repeat leaks, (8) and (9) sanctions unchanged. Sector storage rules are checked separately.

Check or inspection

100%

DB examination

100%

Finding violations

80%

• P det = 100%
• P V = 80%

Court decision

64%

Publication

32%

• P C = 80%
• P M = 40%

TOTAL RISK CALCULATION

2026 fact: DB location is set from the policy and whois, P det is close to one

Si = Ci + Oi × Tlc + Pdet,i × PV,i × (PC,i × M × S1 + PM,i × D)

• lifecycle cost
• total risk

Costs

• Ci
• one-off strategy costs (CapEx)

• Oi
• annual costs (OpEx)

• Tlc
• strategy lifecycle in years

Probabilities

• Pdet,i
• DB detection by the regulator

• PV,i
• finding violations in the detected DB

• PC,i
• violation upheld by a court

• PM,i
• violation publicity

Consequences

• M
• business impact multiplier

• S1
• strategy 1 cost over the lifecycle

• D
• material losses and reputational harm

Example, strategy 4 (interim DB in Russia): S = 30 + 10 × 5 + 1 × 0.4 × (0.2 × 2 × 150 + 0.2 × 30) = 80 + 26.4 = 106.4. Second place after the PD transfer service (100.3).

• Set-up
• Support
• TCO, 5 years
• Total risk
• Rank

• 1
• PDIS moved to Russia
• very high
• low
• high
• no
• 4

• 2
• Switch to paper
• n/a
• n/a
• n/a
• low
• 9

• 3
• DB moved to Russia
• very high
• medium
• high
• low
• 7

• 4
• Interim DB in Russia
• medium
• low
• low
• low
• 2

• 5
• PD transfer service
• low
• low
• low
• medium
• 1

• 6
• Giving up operator status
• high
• no
• medium
• high
• 3

• 7
• Depersonalisation or encryption
• n/a
• n/a
• n/a
• very high
• 10

• 8
• Parallel collection in Russia and abroad
• medium
• low
• low
• very high
• 5

• 9
• Replicating the DB in Russia
• high
• low
• medium
• very high
• 8

• 10
• Leave as is
• no
• no
• no
• very high
• 6

Score scale

• no = 0
• low = 10

• medium = 30
• high = 50

• very high = 100
• n/a = 1000

Example parameters: 5-year lifecycle, medium regulatory risk size (30), medium business impact multiplier (2).

Leaders: PD transfer service, interim DB in Russia, dropping operator status. Moving the PDIS is fourth: risk-free, but costly.

n/a - strategy inapplicable

• PDIS
• 1
• 2
• 3
• 4
• 5
• 6
• 7
• 8
• 9
• 10
• 11
• 12
• 13
• 14
• 15
• 16
• 17
• 18
• 19
• 20
• 21
• 22
• 23
• 24
• 25
• 26
• 27
• 28

• 1
• PDIS moved to Russia
• 1
• 1
• 1
• 2
• 3
• 3
• 2
• 4
• 1
• 1
• 2
• 2
• 1
• 3
• 4
• 4
• 3
• 3
• 4
• 2
• 3
• 1
• 1
• 2
• 2
• 3
• 2
• 2

• 2
• Switch to paper
• 7
• 7
• 7
• 3
• 1
• 4
• 3
• 5
• 7
• 7
• 3
• 3
• 7
• 6
• 5
• 5
• 4
• 4
• 5
• 3
• 4
• 3
• 2
• 5
• 5
• 1
• 1
• 3

• 3
• DB moved to Russia
• 2
• 2
• 2
• 5
• 5
• 2
• 5
• 2
• 2
• 2
• 5
• 5
• 2
• 4
• 2
• 2
• 6
• 6
• 2
• 5
• 1
• 6
• 6
• 7
• 8
• 2
• 5
• 5

• 4
• Interim DB in Russia
• 5
• 4
• 5
• 1
• 2
• 1
• 1
• 1
• 5
• 5
• 1
• 1
• 5
• 1
• 1
• 1
• 1
• 1
• 1
• 1
• 6
• 6
• 6
• 7
• 8
• 5
• 5
• 1

• 6
• Giving up operator status
• 8
• 8
• 6
• 6
• 6
• 5
• 6
• 6
• 8
• 8
• 6
• 6
• 8
• 7
• 7
• 7
• 7
• 7
• 7
• 6
• 2
• 7
• 7
• 8
• 1
• 6
• 6
• 6

• 7
• Depersonalisation or encryption
• 6
• 5
• 8
• 4
• 4
• 7
• 7
• 7
• 6
• 6
• 7
• 7
• 6
• 8
• 8
• 8
• 5
• 5
• 6
• 4
• 5
• 4
• 4
• 1
• 6
• 4
• 3
• 4

• 9
• Replicating the DB in Russia
• 3
• 3
• 3
• 7
• 7
• 6
• 4
• 3
• 3
• 3
• 4
• 4
• 3
• 2
• 3
• 3
• 2
• 2
• 3
• 7
• 7
• 8
• 8
• 3
• 3
• 7
• 7
• 7

• 10
• Leave as is
• 4
• 6
• 4
• 8
• 8
• 8
• 8
• 8
• 4
• 4
• 8
• 8
• 4
• 5
• 6
• 6
• 8
• 8
• 8
• 8
• 8
• 2
• 3
• 4
• 4
• 8
• 8
• 8

FIRST PLACES

14 of 28 interim DB in Russia

• 8 PDIS move
• 3 paper
• 1 DB move
• 1 dropping status
• 1 depersonalisation

Cell colour is the strategy's rank for the system: 1 green, 8 red. Frame - best strategy.

register of PDIS, services, sites, Russians' PD flows

PDIS register and flow map

decide per DB if it is in the primary collection loop

list of primary-loop DBs

calculator per PDIS: costs, probabilities, criticality

scoring and ranking

pick from the PDIS-strategy table, accept residual risk

decision minutes

migration, interim DBs, instructions with Art. 18(5) clause, policy, RKN notice

schemes, contracts, notice

new services and scripts, RKN practice and positions, annual review

change log

Order matters: choose the strategy after the quick scheme, or money goes on moving databases outside the primary collection loop.

PDIS FILE

Infrastructure

Processes

Public documents

Why: courts fix DB location by policy and whois, the operator must prove its measures, and not providing data on RKN request is a separate offence, Art. 19.7 CAO.

1

Reporters in Russia

ABC staff, counterparties, other interested persons

2

Platform site and phone

reports received via web form and dial-in line

3

Platform DB, USA

Platform Provider stores reports as a processor (data processor)

4

ABC, Inc., USA

operator (data controller), gets PD from platform DB

5

ABC Russian affiliates

PD recipients in ad hoc transfers from the US

vs

Reporter's PD

Collected from reporter

collection from subject triggers localisation

from 01.07.2025 Russians' PD may not be recorded or stored in a US database at collection

Others' PD

Received from reporter about others

per the expert view, data from a third party is not collection

but RKN (22.01.2026) counts receiving PD from another person as collection, so it is disputed

Risk: if the operator is a Russian affiliate and the platform collects reports in its interest, localisation stays with it: whoever the collection serves localises

+

Basic tier

Russian companies drop operator status

name ABC, Inc. (USA) the PD operator on the platform

publish Privacy Notice: operator ABC, Inc., Russian affiliates as recipients

sign a no-instruction PD transfer agreement (DTA) between them

Additional tier

Reporter anonymity

keep only an anonymous report option

advise against revealing identity and contacts

give identified reporters Russia-localised channels

2026 assessment

Both strategies are high-risk

per the catalogue, giving operator status to a foreign person and depersonalising at collection are cheap but carry high regulatory risk

Foreign operator

status does not exempt: in 2026 foreign operators were fined under Art. 13.11(8), (9) CAO

Anonymity

a report about others remains PD, and depersonalised data are localised, per RKN oral positions of 2025

Banned from 01.07.2025

parallel collection into Russian and foreign DBs, foreign-to-Russian replication

Initial collection is localised: Russians' PD are recorded and updated in Russian DBs, CBT of collected PD is possible under Art. 12.

Foreign copies, replicas and backups of collected PD at the same operator breach, per Digital Ministry (2025) and RKN (2025-2026).

2026 practice: a flood of cases, (8) - ₽1-2m, (9) - ₽6m, the targeting bar fell to mere site availability.

The strategy is chosen per PDIS by lifecycle cost and total risk, with a margin for onshoring of processing.

t.me/prv_adv